Critical Atlassian Flaw Exposes Files in Eight Self-Hosted Products
Summary
CVE-2026-21589 allows unauthenticated access to specific files in the web roots of eight self-hosted Atlassian products. Atlassian has issued fixes; it reports no evidence of exploitation as of October 7.
Key points
- The vulnerability has a CVSS v4.0 score of 9.3 and affects Bitbucket, Confluence, Jira, Jira Service Management, Bamboo, Crowd, Crucible, and Fisheye self-hosted products.
- An attacker must know the exact filename and path; the flaw does not enable directory listing or file modification or remote code execution.
- Versions before Atlassian’s listed fixed releases are affected. Cloud products have already been patched.
- Atlassian recommends upgrading; until then, restrict public access or use its temporary WAF, reverse-proxy, or product-specific rewrite-rule mitigations.
- Review access and related infrastructure logs for traversal-like requests, encoded path separators, and unusual unauthenticated file-serving activity.
- Atlassian reported no evidence of exploitation as of October 7, but public proof-of-concept material is available.
Article Details
- Vulnerability Types
- Unauthenticated arbitrary file access within the application web root
- Severity
- Critical; CVSS v4.0 score 9.3 (Atlassian internal assessment)
- Exploitation Status
- not_reported
- Exploit Availability
- public_poc
- Patch Status
- available
- Workarounds
- Remove affected instances from public internet access until patched.
- Apply a WAF or reverse-proxy rule for affected products.
- Use Tomcat RewriteValve controls for Confluence, Jira, Jira Service Management, Bamboo, and Crowd.
- Apply a Bitbucket URL-rewrite rule covering cluster nodes, mirrors, and mirror-farm nodes.